Privacy Policy

Privacy Policy

This policy aims to explain fully and clearly what data we collect from you, what happens to that data, and what your rights are in relation to your data. If you have any queries, don’t hesitate to get in touch with us at: info@yorkshiresoundwomen.com.

At Yorkshire Sound Women Network, we respect your right to privacy online and understand that you want to keep control of your personal information. We are committed to protecting any information you share with us.

We will never sell, distribute or intentionally make your personal information public and have implemented appropriate technical and organisational security measures to protect the data you share with us from loss and preserve its security and confidentiality.

We believe in being transparent about what data we are collecting and how it will be handled. The information below sets out our privacy policy in detail. In each case we’ll explain why a particular piece of data is being processed. We are also committed to providing relevant information and control at the point of collection so that you can make informed decisions about what personal data you choose to share with us.

This policy may be updated from time to time so please check back occasionally to make sure you’re happy with any changes.

By using our website or services you’re agreeing to be bound by this policy.

Who are we?

Yorkshire Sound Women Network C.I.C. (hereafter YSWN) was set up to bring like-minded women together to share knowledge and skills in music and sound technology, sonic arts, production and audio electronics.

YSWN provides, through its network, strong, skilled and professional female role models who actively encourage women and girls to participate and develop skills in sound and music digital technology. The organisation encourages and enables both the artistic and technical development of women and girls by providing all female environments, access to resources and skills sharing, and opportunities for collaboration. Operational since 2015, YSWN became a community interest company (C.I.C.) limited by guarantee in 2018.

To fulfil contractual obligations entered into with supporters and funders

To meet wider legal obligations such as those of our grant funders

To support individuals to form networks, run events and projects, and collaborate

To record our campaigning actions and those of our supporters

To meet our community interest company reporting duties

We collect and use a number of different types of data, some of which is personally identifiable and some of which isn’t. We collect data to analyse and report on our projects and events to our funders, to help us communicate with subscribers and participants about opportunities and projects. You can read details of these below.

Our legal basis for processing

We collect and process information about you only where we have a legal basis for doing so.

We will only collect and use your information where:

It is necessary for us to provide you with a service

It satisfies a legitimate interest which is not overridden by your data protection interests, such as for research and development

You have given us consent to do so for a specific purpose

We need to process your data to comply with a legal obligation

In cases where you have consented to our use of your personal information for a specific purpose you have the right to change your mind at any time. Where we are using your information because we have a legitimate interest to do so, you have the right to object to that use.

Website & Cookies

Contact Data for Mailing List

When you sign up to the YSWN online mailing list we ask you to enter personal data in the form of your name, email address and any preferences around what you’ll receive. Your email address is collected so we can send you updates about our work. Any information we share with funders is not connected to personally identifiable information and is made up of aggregated data. We ask for your consent when joining our mailing list and this forms the lawful basis for us holding the data.

General Data Hosting

In order to store data and maintain our services we share your information (which we do so by uploading it to our database (Insightly Customer Relationship Management (CRM) system), including personal information and participation data, with third party service providers who perform various functions to enable us to provide our services and help us operate our business, such as contact management, sending email communications or performing analytics. Information is secured and encrypted on these sites.

All our third-party data processors have been carefully chosen as service suppliers who also practice responsible data handling. We believe that each has in place appropriate protections to ensure the security of the data we store or process with them and have clear policies for how they treat that data. But if in doubt you should review their individual Privacy Policies via the links below.

Transfers outside of the European Economic Area

Under certain circumstances we will transfer your information outside of the European Economic Area. We will only do this with your informed consent, when it is necessary to perform a contract we have with you or where the receiving organisation has adequate safeguards in place – for example certification under the EU-US Privacy Shield framework.

Insightly: YSWN stores and processes personal data using the online CRM platform Insightly. The system allows YSWN to store personal information about individuals in one place. Types of data held by Insightly on behalf of YSWN will include names, job titles, e-mail addresses, telephone numbers, business postal addresses. Insightly’s privacy policy can be found at: insightly.com/privacy-policy

Mailchimp: YSWN stores and processes personal data using Mailchimp in order to distribute e- bulletins, and event invitations. Mailchimp acts as the data processor, and only authorised Mailchimp employees have access to YSWN’s distribution lists. Usually, individuals sign up to YSWN’s Mailchimp lists, at which point they give their consent for Mailchimp and YSWN to process their data for the purposes described at the time. Individuals are given the opportunity with every communication they receive via Mailchimp to view and update the data held about them, and to unsubscribe from the list. Mailchimp’s privacy policy can be found at: mailchimp.com/legal/privacy

Eventbrite: YSWN stores and processes personal data using Eventbrite in order to take bookings and payment (where applicable) for YSWN events. Eventbrite, as the data processor, will process personal data to help administer the event on behalf of YSWN (for example, sending confirmation, promotional and feedback emails, processing payments, etc.) and to help YSWN target, and understand the success of, their event and event planning (for example, providing event reports, using analytics to gain insights into the effectiveness of various sales channels, etc). Eventbrite’s privacy policy can be found at: eventbrite.com/privacypolicy

Survey Monkey: YSWN stores and processes personal data using Survey Monkey in order to undertake consultation and invite feedback relating to YSWN activities and events. Survey Monkey, as the data processor, will process personal data to help administer questionnaires on behalf of YSWN. Survey Monkey’s privacy policy can be found at: surveymonkey.com/mp/legal/privacy-policy

Funders & Participant Data: YSWN shares information with its funders, including Arts Council England and trusts/foundations, for monitoring and evaluation purposes.

YSWN collects data from participants when they join or enrol, which may include personal data: name, email, address, postcode, phone number, date of birth, gender, ethnicity, and if required by the funder, may include information about barriers to learning, information about disabilities, emergency contact information, medical information, attendance information, information about progress and achievements. Where personal information about an individual is shared with funders, such as their name, age, and other demographic information, consent shall be obtained from the individual or the person responsible for that individual prior to the information being shared.

This data is held securely and can only be accessed by members of the YSWN team for whom it is relevant and necessary for them to do their job.

We will only ask for information that is required:

for reporting purposes by the funder or funders of the project, and our reports don’t include any personally identifiable information.

for YSWN to meet our duty of care and deliver our projects safely and to the highest standard.

to notify participants of other useful opportunities via email communication

By signing up as participants, participants agree to be contacted about opportunities and your contact information will be added to our mailing list. This enables YSWN to inform them of changes or information about the project and future projects that may be of interest to them. Participants can unsubscribe from emails anytime by clicking the Unsubscribe button at the bottom of emails.

Social Media

For the purposes of evaluation and marketing, YSWN may documents its work by taking photographs or videos of participants engaging in YSWN activities. These are sometimes shared with social media platforms including Facebook, Instagram, Twitter and YouTube. When working with children and vulnerable adults, permission will always be obtained in writing from those responsible for the participants before any photographs or videos are taken, including consent to share content on social media platforms. Where permission is refused for a particular child to be photographed, care is taken to ensure that that child is not photographed.

Photos and film footage

Photos and film are classed as personal information. We will from time to time photograph projects, including performances, events and workshop activity to use as evidence to report to our funders, and in our marketing. Participants (and their parents/carers of children and young people participants) signing up to YSWN activities will be asked to indicate consent to have their photo taken and be included in film footage. We will always notify participants that a photographer or film maker will be at a session or event, and by bringing to our attention that you do not want to be photographed or filmed when this happens, we can ensure the photographer is aware of this at the time. Where permission is refused for a particular child to be photographed, care is taken to ensure that that child is not photographed.

We may also from time to time photograph and film events. If this is the case, clear signage will be displayed to notify audience members that this is happening. Any audience members not wishing to be filmed or photographed must bring this to the attention of a member of staff, the photographer or the filmmaker so that measures can be taken to enable this.

Take Down Policy

If you see a photo or a film that has been placed in the public domain by YSWN in which you appear where you have requested not to be included, you can inform us in writing to info@yorkshiresoundwomen.com with details of the photo or film and we will remove it immediately or take measures to edit accordingly where possible.

When contacting us via email

If you contact YSWN via email – to any of our staff or other email addresses such as info@yorkshiresoundwomen.com, you will not be added to our mailing list. Your email will be used by those email accounts only for correspondence relating to your enquiry or business issues relevant to you resulting from your email.

Google Analytics

We use Google Analytics to inform us about our digital audience demographics, including: the age and gender of our users, along with the interests they express through their online travel and purchasing activities. We will use the data provided by Google Analytics to develop our website and content around our users’ interests. The data is provided in aggregate and is not personally identifiable to us. You can opt-out of Google Analytics using their add-on to disable tracking by Google Analytics and you can see Google’s privacy policy here.

Unsubscribing

Under the GDPR you have the right to withdraw your consent to us holding your personal data. Should you choose to do this we are obliged to act on your request as soon as possible and at least within one month. Every email we send you will have an unsubscribe option at the bottom and additionally you can send us an email at any time to info@yorkshiresoundwomen.com.

Your rights

Under the General Data Protection Regulation (GDPR) anyone whose personal data is stored by YSWN has a set of rights relating to it. Those rights are as follows:

The right to be informed

The right of access

The right to rectification

The right to erase

The right to restrict processing

The right to data portability

The right to object

Rights in relation to automated decision making and profiling.

You may exercise your right to be forgotten by requesting that YSWN remove all personal data relating to yourself from YSWN’s databases and data storage. In the case that an individual requests this, YSWN will take all reasonable steps to remove or anonymise the data held about the individual. If you would like to exercise one or more of the rights in relation to the data we hold about you please let us know in writing via info@yorkshiresoundwomen.com and we will be happy to help. For information on what these rights mean please visit the Information Commissioner’s Office website.

Personal Data Breaches

A breach is considered any loss, alteration, unauthorised disclosure of, or access to, personal data. We are committed to disclosing any personal data breaches that might adversely affect your rights and freedoms without undue delay so that you can take appropriate action. Any notifiable breaches will also be reported to the UK’s Information Commissioner’s Office within 72 hrs. This includes breaches affecting the third party services identified in this privacy policy, where personal data is being held on our behalf.

Complaints regarding personal data

If you think we are handling your data incorrectly you should approach us in the first instance and we will do everything possible to rectify the situation. If you are not happy with our response you have a right to contact the supervisory authority, in this case the Information Commissioner’s Office. You can lodge a complaint through their website here and in turn, they will deal with it.

Data Management Policy

1. Context and overview

Introduction

These can include participants, network members, suppliers, business contacts, employees and other people the organisation has a relationship with or may need to contact.

This policy describes how this personal data must be collected, handled and stored to meet the company’s data protection standards – and to comply with the law.

Why this policy exists

This data management policy ensures YSWN:

Complies with data protection law and follows good practice

Protects the rights of customers, staff and partners

Is transparent about how it stores and processes individuals’ data

Protects itself from the risks of a data breach

Data protection law

The General Data Protection Regulation (GDPR) applies in the UK and across the EU from May 2018. It requires personal data shall be:

Processed lawfully, fairly and in a transparent manner in relation to individuals;

Collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research or statistical purposes shall not be considered to be incompatible with the initial purposes;

Adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed;

Accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay;

Kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes subject to implementation of the appropriate technical and organisational measures required by GDPR in order to safeguard the rights and freedoms of individuals;

Processed in a manner that ensures appropriate security of personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.

The controller shall be responsible for, and be able to demonstrate, compliance with the principles.

2. People and responsibilities

Everyone at YSWN contributes to compliance with GDPR. Directors and Associates must understand the requirements and accountability of the organisation sufficiently to prioritise and support the implementation of compliance.

Key areas of responsibility are detailed below:

Data Protection Officer (DPO) – the person responsible for fulfilling the tasks of the DPO in respect of YSWN is Abi Bliss, Director. The minimum tasks of the DPO are:

To inform and advise YSWN all who work on behalf of YSWN about their obligations to comply with the GDPR and other data protection laws

Evaluating any third party services the company is considering using to store or process data, to ensure their compliance with obligations under the regulations

Developing privacy notices to reflect lawful basis for fair processing, ensuring that intended uses are clearly articulated, and that data subjects understand how they can give or withdraw consent, or else otherwise exercise their rights in relation to the companies use of their data

YSWN Directors and Associates can contribute to YSWN’s compliance with data protection law by following these guidelines:

Emails

When sending e-mails to multiple addressees, keep the mailing list private by typing the e-mail addresses in the BCC field, unless you are certain that the recipients have given consent for their e-mail addresses to be shared with that particular group.

Do not send sensitive data via e-mail, unless it is unavoidable.

Delete any e-mails containing sensitive data once the data has been transferred to the relevant database.

Devices

Keep laptops secure, and do not leave unattended in any public areas.

Ensure any device and cloud storage account passwords are strong and unique to each device.

If you are a self-employed worker and need to access the YSWN cloud storage using your own device, ensure that the device is password protected, and that data is not duplicated onto your device. Self-employed workers will be given limited access only to data that is necessary to their work with YSWN.

Ensure anti-virus software is installed on all devices and kept up-to-date.

Ensure software and operating system updates are installed at the earliest opportunity.

Keep devices locked when unattended.

Contact lists

Regularly review and update contact records and delete any for which there is no longer a legitimate reason for them to be kept.

If you are given somebody’s personal details, add them immediately to the appropriate contact database: Insightly for professional contacts; Mailchimp for Network members. Delete the data from any other location.

If you notice that any data held is incorrect or out-of-date, immediately update or remove the data.

If you need to store personal data in one place for an event or project, for example in keeping an attendee list with contact details, ensure that the list is not duplicated. Delete the list from the cloud storage as soon as it is no longer in use.

Do not create unnecessary duplicates of data lists. An individual’s data should ideally only be stored in one place.

Collecting data

If you are collecting personal data from any individual, ensure the YSWN privacy notice is visible to the data subject within the paper or online form. The privacy notice should explain: who we are; what data is being collected; why the data is being collected; how the data will be used; how the subject can exercise their rights. Ensure that the individual has the opportunity to give their consent for YSWN to contact them using the data they provide.

3. Scope of personal information to be processed

YSWN processes the following personal data:

names of individuals

email addresses

postcode

phone number

date of birth

gender

ethnicity

emergency contact information

and if required by the funder: information about barriers to learning, information about disabilities, medical information, attendance information, information about progress and achievements.

YSWN collects the information directly from the data subject, through YSWN sign-up forms; ticket order forms; project registration forms; job application forms. YSWN also holds data relating to professional contacts which is publicly available or has been given to YSWN. Personal data will be stored on YSWN’s online password protected CRM (Insightly); in online accounts for Mailchimp and Eventbrite, only for the purposes of sending e-mails and taking event ticket payment and bookings, respectively; on staff computers, accessed via a shared Dropbox folder, and only for the duration of the management of events and projects; and in certain circumstances in hard copy format, kept in a secure place.

YSWN will ensure that the data it holds is accurate by holding data only in the locations necessary as described above, and assigning one master database as a shared address book. The master database will be held using online CRM Insightly, and collected data will be transferred to it at the earliest opportunity, and at least on a monthly basis. YSWN will ensure that the data it holds is relevant to the purpose, not excessive, and is up-to-date, by reviewing the master database against any new data collected regularly. YSWN will ensure that the data is only held for the duration necessary to carry out the purpose and not kept for longer than is necessary.

6. Data Sharing

YSWN sometimes shares personal data with certain third-party organisations. Any organisation which processes data on behalf of YSWN is also subject to compliance with GDPR as a Data Processor. YSWN will ensure that any third party data processor is able to sufficiently demonstrate its data security and compliance with GDPR.

Insightly: YSWN stores and processes personal data using the online CRM platform Insightly. The system allows YSWN to store personal information about individuals in one place. Types of data held by Insightly on behalf of YSWN will include names, job titles, e-mail addresses, telephone numbers, business postal addresses. Insightly’s privacy policy can be found at: insightly.com/privacy-policy.

Mailchimp: YSWN stores and processes personal data using Mailchimp in order to distribute e-bulletins, and event invitations. Mailchimp acts as the data processor, and only authorised Mailchimp employees have access to YSWN’s distribution lists. Usually, individuals sign up to YSWN’s Mailchimp lists, at which point they give their consent for Mailchimp and YSWN to process their data for the purposes described at the time. Individuals are given the opportunity with every communication they receive via Mailchimp to view and update the data held about them, and to unsubscribe from the list. Mailchimp’s privacy policy can be found at: mailchimp.com/legal/privacy.

Eventbrite: YSWN stores and processes personal data using Eventbrite in order to take bookings and payment (where applicable) for YSWN events. Eventbrite, as the data processor, will process personal data to help administer the event on behalf of YSWN (for example, sending confirmation, promotional and feedback emails, processing payments, etc.) and to help YSWN target, and understand the success of, their event and event planning (for example, providing event reports, using analytics to gain insights into the effectiveness of various sales channels, etc). Eventbrite’s privacy policy can be found at: eventbrite.com/privacypolicy.

Survey Monkey: YSWN stores and processes personal data using SurveyMonkey in order to undertake consultation and invite feedback relating to YSWN activities and events. Survey Monkey, as the data processor, will process personal data to help administer questionnaires on behalf of YSWN. Survey Monkey’s privacy policy can be found at: surveymonkey.com/mp/legal/privacy-policy.

Funders

YSWN shares information with its funders, including Arts Council England and trusts/foundations, for monitoring and evaluation purposes.

YSWN collects data from participants when they join or enrol, which may include personal data: name, email, address, postcode, phone number, date of birth, gender, ethnicity, and if required by the funder, may include information about barriers to learning, information about disabilities, emergency contact information, medical information, attendance information, information about progress and achievements. Where personal information about an individual is shared with funders, such as their name, age, and other demographic information, consent shall be obtained from the individual or the person responsible for that individual prior to the information being shared.

This data is held securely and can only be accessed by members of the YSWN team for whom it is relevant and necessary for them to do their job.

We will only ask for information that is required:

for reporting purposes by the funder or funders of the project, and our reports don’t include any personally identifiable information.

for YSWN to meet our duty of care and deliver our projects safely and to the highest standard.

to notify participants of other useful opportunities via email communication

By signing up as participants, participants agree to be contacted about opportunities and your contact information will be added to our mailing list. This enables YSWN to inform them of changes or information about the project and future projects that may be of interest to them. Participants can unsubscribe from emails anytime by clicking the Unsubscribe button at the bottom of emails.

Social Media

For the purposes of evaluation and marketing, YSWN may documents its work by taking photographs or videos of participants engaging in YSWN activities. These are sometimes shared with social media platforms including Facebook, Instagram, Twitter and Youtube. When working with children and vulnerable adults, permission will always be obtained in writing from those responsible for the participants before any photographs or videos are taken, including consent to share content on social media platforms. Where permission is refused for a particular child to be photographed, care is taken to ensure that that child is not photographed.

Disclosing data for other reasons

Under certain circumstances YSWN may be required to disclose personal data to law enforcement agencies without the consent of the data subject. YSWN will ensure the request is legitimate and will seek legal advice where necessary.

7. Security measures

YSWN ensures that the personal data it stores is protected from a data security breach. The following measures are in place to protect data from breach.

Digital data is held and accessed on several desktop computers and laptops – each of which is password protected.

Laptops are kept securely by YSWN Directors and Associates staff and are not left unattended in any public areas.

Data is stored using online and cloud software accessed only by YSWN staff and protected by login and password details.

Device and cloud storage account passwords are strong and unique to each device.

Dropbox, the cloud software used by YSWN, employs a data back-up system which saves a history of all deleted and previous versions of files, and allows users to restore them for up to 30 days.

Notifications from Dropbox alert the account holder to any unusual activity in the account, such as a log-in from an unknown device.

Only YSWN staff have access to the YSWN devices. When a self-employed worker needs to access the YSWN cloud storage using their own device, they ensure that the device is password protected, and that data is not duplicated onto their device. Self-employed workers are given limited access only to data that is necessary to their work with YSWN.

Anti-virus software is installed on all devices and kept up-to-date.

Software and operating system updates are installed at the earliest opportunity.

Any hard copy data is held in secured filing cabinets in RS 1/23, University of Huddersfield. Hard copy data which is no longer required is shredded.

Hard copy documents containing personal data are not left in view out of hours or taken off-site unless they relate to and are required at a specific event.

Personal and sensitive data is not sent via e-mail unless unavoidable.

8. Automated processing

YSWN does not use automated processing or decision making, nor any profiling of individuals

9. Subject access requests

All individuals who are the subject of data held by YSWN are entitled to:

Ask what information YSWN holds about them and why

Ask how to gain access to it

Be informed how to keep it up to date

Be informed how the company is meeting its data protection obligations

In all marketing communications individuals are notified of the process for updating the details YSWN holds about them, or to unsubscribe from further communications. Individuals are also notified at the point of submitting data to YSWN that they may withdraw their consent for YSWN to process their data at any time, by contacting YSWN directly on info@yorkshiresoundwomen.com.

In the case of a subject access request, YSWN will ensure that the identity of the individual is verified, before providing all the data held by YSWN to the individual as soon as possible, and within 30 days.

10. The right to be forgotten

Data subjects may exercise their right to be forgotten by requesting that YSWN remove all personal data relating to the individual from YSWN’s databases and data storage. In the case that an individual requests this, YSWN will take all reasonable steps to remove or anonymise the data held about the individual. Data is held by YSWN in a limited number of locations. Third party data processors Insightly, Mailchimp and Eventbrite include tools for searching for and removing data about individuals. Only limited data are held on YSWN’s cloud storage, but a digital search for data about the individual will be conducted to ensure nothing remains on the system. Hard copy records are likely to be HR or financial records, which YSWN has a lawful obligation to store.

11. Privacy notices

YSWN aims to ensure that individuals are aware that their data is being processed, and that they understand:

Who is processing their data

What data is involved

The purpose for processing that data

The outcomes of data processing

How to exercise their rights

To these ends YSWN has a privacy statement, setting out how data relating to individuals is used by YSWN. The privacy statement can be viewed on the YSWN website. In addition to the Privacy Statement, YSWN issues privacy notices to individuals at the point that they submit their personal data to YSWN. The privacy notice below is one variation used for subscribers to the YSWN mailing list.

Your details are confidential and they won’t be shared. Also, we will only send news about events, fundraising and member related news. Yorkshire Sound Women Network will use the information you provide on this form to be in touch with you and to provide updates and marketing. Please let us know all the ways you would like to hear from us:

YSWN can send me information via email

You can change your mind at any time by clicking the unsubscribe link in the footer of any email you receive from us, or by contacting us at info@yorkshiresoundwomen.com. We will treat your information with respect. For more information about our privacy practices please visit our website. By clicking below, you agree that we may process your information in accordance with these terms.

12. Ongoing documentation of measures to ensure compliance

Meeting the obligations of the GDPR to ensure compliance will be an ongoing process. YSWN’s DPO, supported by Directors and Associates, will:

Maintain documentation/evidence of the privacy measures implemented and records of compliance

Regularly test the privacy measures implemented and maintain records of the testing and outcomes.

Use the results of testing, other audits, or metrics to demonstrate both existing and continuous compliance improvement efforts.